php login error username and password missing

Question

I have problems with my login page, can someone help me with this error, down is the code of the login page, and when i press login button, it says Username missing, Password Missing. Can someone help me with this error, where the problem is or what is wrong? Thanks

<?php
    //Start session
    session_start();

    //Array to store validation errors
    $errmsg_arr = array();

    //Validation error flag
    $errflag = false;

    //Connect to mysql server
    $link = mysqli_connect('localhost','root',"");
    if(!$link) {
        die('Failed to connect to server: ' . mysqli_error());
    }

    //Select database
    $db = mysqli_select_db($link, 'sales');
    if(!$db) {
        die("Unable to select database");
    }

    //Function to sanitize values received from the form. Prevents SQL injection
    function clean($str) {
        $str = @trim($str);
        if(get_magic_quotes_gpc()) {
            $str = stripslashes($str);
        }
        return mysqli_real_escape_string($str);
    }

    //Sanitize the POST values
    $login = clean($_POST['username']);
    $password = clean($_POST['password']);

    //Input Validations
    if($login == '') {
        $errmsg_arr[] = 'Username missing';
        $errflag = true;
    }
    if($password == '') {
        $errmsg_arr[] = 'Password missing';
        $errflag = true;
    }

    //If there are input validations, redirect back to the login form
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: index.php");
        exit();
    }

    //Create query
    $qry="SELECT username,password FROM 'user' WHERE username='$login' AND password='$password'";
    $result=mysqli_query($qry);

    //Check whether the query was successful or not
    if($result) {
        if(mysqli_num_rows($result) > 0) {
            //Login Successful
            session_regenerate_id();
            $member = mysqli_fetch_assoc($result);
            $_SESSION['SESS_MEMBER_ID'] = $member['id'];
            $_SESSION['SESS_FIRST_NAME'] = $member['name'];
            $_SESSION['SESS_LAST_NAME'] = $member['position'];
            //$_SESSION['SESS_PRO_PIC'] = $member['profImage'];
            session_write_close();
            header("location: main/index.php");
            exit();
        }else {
            //Login failed
            header("location: index.php");
            exit();
        }
    }else {
        die("Query failed");
    }
?>

and this is the index page

<?php
 //Start session
 session_start();
 
 //Unset the variables stored in session
 unset($_SESSION['SESS_MEMBER_ID']);
 unset($_SESSION['SESS_FIRST_NAME']);
 unset($_SESSION['SESS_LAST_NAME']);
?>
<html>
<head>
<title>
POS
</title>
    <link rel="shortcut icon" href="main/images/pos.jpg">

  <link href="main/css/bootstrap.css" rel="stylesheet">

    <link rel="stylesheet" type="text/css" href="main/css/DT_bootstrap.css">
  
  <link rel="stylesheet" href="main/css/font-awesome.min.css">
    <style type="text/css">
      body {
        padding-top: 60px;
        padding-bottom: 40px;
      }
      .sidebar-nav {
        padding: 9px 0;
      }
    </style>
    <link href="main/css/bootstrap-responsive.css" rel="stylesheet">

<link href="style.css" media="screen" rel="stylesheet" type="text/css" />
</head>
<body>
    <div class="container-fluid">
      <div class="row-fluid">
  <div class="span4">
  </div>
 
</div>
<div id="login">
<?php
if( isset($_SESSION['ERRMSG_ARR']) && is_array($_SESSION['ERRMSG_ARR']) && count($_SESSION['ERRMSG_ARR']) >0 ) {
 foreach($_SESSION['ERRMSG_ARR'] as $msg) {
  echo '<div style="color: red; text-align: center;">',$msg,'</div><br>'; 
 }
 unset($_SESSION['ERRMSG_ARR']);
}
?>
<form action="login.php" method="post">

   <font style=" font:bold 44px 'Aleo'; text-shadow:1px 1px 15px #000; color:#fff;"><center>EREC`s Pharmacy</center></font>
  <br>

  
<div class="input-prepend">
  <span style="height:30px; width:25px;" class="add-on"><i class="icon-user icon-2x"></i></span><input style="height:40px;" type="text" name="username" Placeholder="Username" required/><br>
</div>
<div class="input-prepend">
 <span style="height:30px; width:25px;" class="add-on"><i class="icon-lock icon-2x"></i></span><input type="password" style="height:40px;" name="password" Placeholder="Password" required/><br>
  </div>
  <div class="qwe">
   <button class="btn btn-large btn-primary btn-block pull-right" href="dashboard.html" type="submit"><i class="icon-signin icon-large"></i> Login</button>
</div>
   </form>
</div>
</div>
</div>
</div>
</body>
</html>

Welcome to Stack Overflow! Please take the [tour](https://stackoverflow.com/tour), have a look around, and read through the [help center](https://stackoverflow.com/help) , in particular [How do I ask a good question?](https://stackoverflow.com/help/how-to-ask) and [What topics can I ask about here?](https://stackoverflow.com/help/on-topic). — Yagami Light, Jul 02 '17 at 12:38
Looking at this code: Your issue most likely is in the form itself. Without posting your HTML, we're unable to help. — Blue, Jul 02 '17 at 12:50
`return mysqli_real_escape_string($str);` in your `clean()` function (you probably shouldn't use things like that `clean()` you probably shouldn't use anyway), that needs a MySQLi connection and that's a scope issue — Qirel, Jul 02 '17 at 12:56
and what should i change in that code? i have tried something, but nothing is working for now... — admin paffy, Jul 02 '17 at 13:09
Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Jul 02 '17 at 14:34

score 0 · Accepted Answer · answered Jul 02 '17 at 17:50

i found the solution. The problem was i removed the code below

function clean($str) {
    $str = @trim($str);
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    return mysqli_real_escape_string($str);
}

and i added this code:

    $login = $_POST['username'] =    filter_var($_POST['username'], FILTER_SANITIZE_EMAIL); 
$password = $_POST['password'] = filter_var($_POST['password'], FILTER_SANITIZE_STRING);

Removed the code also:

  $login = clean($_POST['username']);
$password = clean($_POST['password']);

and in the code query added:

 $qry="SELECT * FROM user WHERE username='$login' AND password='$password'";
$result=mysqli_query($link, $qry);

php login error username and password missing

1 Answers1